Boris Ding

Web Developer

[VoidZero @voidzerodev]

Introducing tsrs: a Rust port of the TypeScript compiler 🦀

We are not forking TypeScript!

◆ In close collaborating with the TypeScript team
◆ Up to 8x faster than TS 7.0 & ~70% less memory
◆ Runs in WASM, so it works in your browser & on Workers
◆ Soon part of the Oxc toolchain

npx tsrs

https://t.co/qmmxF3YnQy

[TANSTACK @tan_stack]

TanStack Start 1.0 is officially stable! 🎉

A full-stack web framework for React and Solid, already used to build millions of apps, from Fortune 500 companies to your favorite tools and weekend projects.

https://t.co/DA8E8cWnBU

[Turso @tursodatabase]

Turso is joining @supabase.

Together, we're building the database platform for the agentic era: everything agents need, from lightweight databases to Postgres at petabyte scale.

More details in thread. 👇

[Marc Lou @marclou]

I just wrote my first book 📚

I talk about failing for 7 years, depression, and negative thoughts. It's not really sexy, but I want to share the things that don't go viral on social media.

It's free. Please let me know if you enjoy it, that means a lot to me 😊

→ https://t.co/PaqkOsgu5S

[PocketJS @pocket_js]

Now we are possibly the first cross-platform UI framework for smart watches 😎

@RyanCarniato have you ever imagined SolidJS running on a watch?

[David Senra @davidsenra]

People are like "You're just running a lifestyle business."

“Yeah I have a business and a lifestyle and my lifestyle happens to include a fucking yellow Lamborghini.”

[David Haz @davidhaz]

Introducing Canvas UI, the first ever html-in-canvas component library.

Your DOM is the render target now. Real-time shaders over real, interactive UI.

24 components. React, Vue, Svelte, vanilla TS.

Free. Open source. 🧵
https://t.co/Y5ZZDNxPUX

[shadcn @shadcn]

React Aria is now available in shadcn/ui.

Use `--base aria` or choose React Aria in shadcn/create.

All components, docs, CLI, styles and skills have been updated for React Aria Components.

Shoutout to @devongovett who did most of the work behind this release.

[Aiden Bai @aidenybai]

/improve-react uses React Doctor under the hood to find issues

Run in terminal to install:

npx skills add https://t.co/lmGnTiM5px --skill improve-react

(inspired by improve skill by @shadcn)

[Archie Sengupta @archiexzzz]

the attacker injected a package called `[email protected].` this dependency is never actually used by axios - its only function is to trigger a "postinstall" script.

the script acts as a remote access trojan (rat) dropper that targets macos, windows, and linux systems alike.

once active, the dropper contacts a command-and-control (c2) server at sfrclak[.]com to download platform-specific second-stage payloads. to evade forensic detection, the malware deletes its own footprint and replaces its package.json with a clean version immediately after execution.

if you have installed either of the affected axios versions, assume your system is compromised.

indicators of compromise (iocs)

malicious packages:
[email protected]
[email protected]
[email protected]

network c2:
sfrclak[.]com (ip: 142.11.206.73)

platform-specific files:
macos: /library/caches/com.apple.act.mond
windows: %programdata%\wt.exe
linux: /tmp/ld.py

remediation steps:

> revert and pin: downgrade to last known safe versions: [email protected] (for 1.x users); [email protected] (for 0.x users).

>rotate creds: rotate all secrets, api keys, and credentials stored on or accessed by exposed machines.

>audit logs: check network logs for outbound connections to sfrclak[.]com or 142.11.206.73.

>harden ci/cd: use npm install --ignore-scripts in ci environments to block malicious postinstall scripts.

[RyotaK @ryotkak]

Another vulnerability in React Server Components (CVE-2026-23864) that I reported was disclosed today.

This is separate from the one disclosed in December, so you'll need to update again.

https://t.co/k7hgEzIWDb

[Matteo Collina @matteocollina]

Today, @nodejs published a security release for Node.js that fixes a critical bug affecting virtually every production Node.js app.

If you use React Server Components, Next.js, or ANY APM tool (Datadog, New Relic, OpenTelemetry), your app could be vulnerable to DoS attacks.

👇

[🦋 @NJZBAM2]

meta ai is scary cause wdym they translate videos with realistic voices and edit ur mouth movements to match different languages…

[React @reactjs]

Researchers have found two new vulnerabilities in React Server Components while attempting to exploit the patches last week.

These are new issues, separate from the critical CVE last week. The patch for React2Shell remains effective for the Remote Code Execution exploit.

[DHH @dhh]

Microservices is the software industry’s most successful confidence scam. It convinces small teams that they are “thinking big” while systematically destroying their ability to move at all. It flatters ambition by weaponizing insecurity: if you’re not running a constellation of services, are you even a real company? Never mind that this architecture was invented to cope with organizational dysfunction at planetary scale. Now it’s being prescribed to teams that still share a Slack channel and a lunch table.

Small teams run on shared context. That is their superpower. Everyone can reason end-to-end. Everyone can change anything. Microservices vaporize that advantage on contact. They replace shared understanding with distributed ignorance. No one owns the whole anymore. Everyone owns a shard. The system becomes something that merely happens to the team, rather than something the team actively understands. This isn’t sophistication. It’s abdication.

Then comes the operational farce. Each service demands its own pipeline, secrets, alerts, metrics, dashboards, permissions, backups, and rituals of appeasement. You don’t “deploy” anymore—you synchronize a fleet. One bug now requires a multi-service autopsy. A feature release becomes a coordination exercise across artificial borders you invented for no reason. You didn’t simplify your system. You shattered it and called the debris “architecture.”

Microservices also lock incompetence in amber. You are forced to define APIs before you understand your own business. Guesses become contracts. Bad ideas become permanent dependencies. Every early mistake metastasizes through the network. In a monolith, wrong thinking is corrected with a refactor. In microservices, wrong thinking becomes infrastructure. You don’t just regret it—you host it, version it, and monitor it.

The claim that monoliths don’t scale is one of the dumbest lies in modern engineering folklore. What doesn’t scale is chaos. What doesn’t scale is process cosplay. What doesn’t scale is pretending you’re Netflix while shipping a glorified CRUD app. Monoliths scale just fine when teams have discipline, tests, and restraint. But restraint isn’t fashionable, and boring doesn’t make conference talks.

Microservices for small teams is not a technical mistake—it is a philosophical failure. It announces, loudly, that the team does not trust itself to understand its own system. It replaces accountability with protocol and momentum with middleware. You don’t get “future proofing.” You get permanent drag. And by the time you finally earn the scale that might justify this circus, your speed, your clarity, and your product instincts will already be gone.

[Jason Fried @jasonfried]

INTRODUCING FIZZY

Have you noticed that every issue and idea tracking tool you loved slowly morphed into boring, sluggish, corporate bloatware?

Trello put on 40 pounds of cruft. Jira started charging by the migraine. Asana tried to become everything to everyone. GitHub Issues slipped into a steady state of decline. The whole category is a 20 car pileup of complexity.

Time to route around that mess.

Today we’re introducing Fizzy. Kanban as it should be, not as it has been.

Fizzy is a fresh take on cards and columns, with a few twists, human-nature inspired defaults, and a vibrant interface that’s the opposite of the bland and boring software the industry has been flinging at you for years.

Kanban has been around since the 1940s, and Trello brought it into the mainstream in 2011. Since then, some version of column-based kanban-style organization has found its way into any collaboration tool worth its salt.

But most have over salted the dish.

What was simple is now complicated. What was clear is now cluttered. What just worked now takes work.

Fizzy presses reset, reconsiders what really matters, and presents a refreshing way to kanban that just feels right. It’s friendly, colorful, straightforward, and fast as hell.

We still use Basecamp for our big, intensive projects, but lately we’ve been reaching for Fizzy to run the smaller ones. It’s perfect for tracking bugs, issues, and ideas, and it shines for lighter, self-contained workflows like podcasts or video production.

We didn’t expect it, but Fizzy’s so good it might even cannibalize Basecamp on the lighter side of project management. We’d be thrilled.

How much is it? It’s not much for so much.

Everyone gets 1000 cards for free. Beyond that, we’ll host your account for just $20/month for unlimited cards and unlimited users. One price for all and everything. No tiers, no “contact us.” No pricing chart at all — just a price tag, like on a pair of jeans.

And here’s a surprise... Fizzy is open source! If you’d prefer not to pay us, or you want to customize Fizzy for your own use, you can run it yourself for free forever. Have a great idea? Submit a PR to contribute to the code base and improve the product for everyone. It’s the best of all worlds. No excuses.

Every idea comes back around. It’s time for take two on kanban. Fizzy’s our hat in the ring.

Let’s make this platform insanely great, together. Come on in!

Visit https://t.co/EsRclBqc3q

[React @reactjs]

There is critical vulnerability in React Server Components disclosed as CVE-2025-55182 that impacts React 19 and frameworks that use it.

A fix has been published in React versions 19.0.1, 19.1.2, and 19.2.1. We recommend upgrading immediately.

https://t.co/kue7kd0XEX

[JNS @_devJNS]

1995: PHP is dead, learn ColdFusion
2003: PHP is dead, learn Django
2004: PHP is dead, learn Ruby on Rails
2010: PHP is dead, learn Flask
2011: PHP is dead, learn AngularJS
2016: PHP is dead, learn Next.js
2022: PHP is dead, learn Go
2025: Okay this is weird...

[Wes Bos @wesbos]

Don't [...spread] or .split() your strings!

Use Intl.Segmenter API. Available in every JS runtime

[tobi lutke @tobi]

@yatish_me microservices are a solution for a political problem, not a technological one